Multiple vulnerabilities have been found in Python, the worst of which could lead to arbitrary code execution.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201503-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Python: Multiple vulnerabilities Date: March 18, 2015 Bugs: #495224, #500518, #505068, #506084, #514686, #523792, #532232 ID: 201503-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in Python, the worst of which could lead to arbitrary code execution. Background ========= Python is an interpreted, interactive, object-oriented programming language. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-lang/python < 3.3.5-r1 *> = 2.7.9-r1 > = 3.3.5-r1 Description ========== Multiple vulnerabilities have been discovered in Python. Please review the CVE identifiers referenced below for details. Impact ===== A context-dependent attacker may be able to execute arbitrary code or cause a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All Python 3.3 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-lang/python-3.3.5-r1" All Python 2.7 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.9-r1" References ========= [ 1 ] CVE-2013-1752 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1752 [ 2 ] CVE-2013-7338 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7338 [ 3 ] CVE-2014-1912 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1912 [ 4 ] CVE-2014-2667 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2667 [ 5 ] CVE-2014-4616 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4616 [ 6 ] CVE-2014-7185 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7185 [ 7 ] CVE-2014-9365 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9365 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201503-10 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Security support for asterisk, an Open Source PBX and telephony toolkit, has been discontinued for the oldstable distribution (etch). The current version in oldstable is not supported by upstream anymore and is affected by several security issues. Backporting fixes for these . - ------------------------------------------------------------------------ Debian Security Advisory DSA-1952-2
Several integer overflows have been discovered by its upstream developers in libpng, a commonly used library to display PNG graphics. They could be exploited to cause arbitrary code to be executed when a specially crafted PNG image is processed.. -------------------------------------------------------------------------- Debian Security Advisory DSA 571-1
Get the latest Linux and open source security news straight to your inbox.